[每日信息流] 2026-03-06 #1169
Description
每日安全资讯（2026-03-06）
- SecWiki News
- Private Feed for M09Ic
- x90skysn3k released v2.5.3 at x90skysn3k/brutespray
- PrefectHQ released 3.6.21 at PrefectHQ/prefect
- bolucat released 202603052021 at bolucat/Archive
- CHYbeta starred cft0808/edict
- 4ra1n starred HeadyZhang/agent-audit
- CHYbeta starred smxiazi/xia_Liao
- liamg starred owenrumney/schnappit
- 0xbug starred youhunwl/TVAPP
- safedv starred epotseluevskaya/ASPX_WebShell_COFFLoader
- niudaii starred D4Vinci/Scrapling
- zema1 starred Hackndo/pyGPOAbuse
- lz520520 starred p1g3/dingwave
- pmiaowu starred SanMuzZzZz/LuaN1aoAgent
- CHYbeta starred ringhyacinth/Star-Office-UI
- ManassehZhou starred KeygraphHQ/shannon
- 0xbug starred pinchtab/pinchtab
- gh0stkey starred RunanywhereAI/runanywhere-sdks
- PrefectHQ released 3.6.21.dev5 at PrefectHQ/prefect
- CHYbeta starred adversa-ai/secureclaw
- zeroclaw-labs released v0.1.8 at zeroclaw-labs/zeroclaw
- zema1 starred biggerstar/wedecode
- Recent Commits to cve:main
- Tenable Blog
- Microsoft Security Blog
- paper - Last paper
- 嘶吼 RoarTalk – 网络安全行业综合服务平台,4hou.com
- Doonsec's feed
- 用 Claude 把 GitHub 漏洞数据库变成代码审计 Skill
- 天地伟业Easy7 uploadMapServerBgImage接口存在任意文件上传漏洞 附POC
- 玩转OpenClaw｜云上OpenClaw快速接入飞书指南
- 为隐私而生的广告ID，成了美国边境监控的核心工具
- 【服务端漏洞-访问控制缺失-第三章第一节】身份验证漏洞攻击指南（基础篇）：认证、授权与暴力破解逻辑
- 一个网站治好你面对流量分析的头疼！
- Wireshark进阶技巧:通过DNS查询来分析可疑流量中恶意软件感染事件
- 美以胖揍伊朗的几个误读
- SRC系列——某高校食堂支付程序惊现“0元购”？SRC支付逻辑漏洞
- 2025年全球恐怖主义指数
- SRC实战系列-图形验证码之滑块
- 【资料】西方智库分析认为：伊朗导弹即将耗尽
- ElcomSoft blog
- Armin Ronacher's Thoughts and Writings
- Horizon3.ai
- Malwarebytes
- Reverse Engineering
- blog.avast.com EN
- rtl-sdr.com
- 奇客Solidot–传递最新科技情报
- 黑海洋Wiki | AI机器人硬件开发 | 网络安全攻防实战 | 区块链技术文档教程 - 免费资源平台
- HackerNews
- 威努特安全网络
- vivo千镜
- 黑鸟
- 安全分析与研究
- 看雪学苑
- 安全客
- 安全内参
- 天御攻防实验室
- 信息安全国家工程研究中心
- 奇安信 CERT
- 代码卫士
- 安全圈
- 威胁棱镜
- 中国信息安全
- 安全学术圈
- 青藤云安全
- 天黑说嘿话
- 安全牛
- 吾爱破解论坛
- 慢雾科技
- 数世咨询
- 阿里安全响应中心
- 信安之路
- 极客公园
- 火绒安全
- 嘶吼专业版
- 复旦白泽战队
- 360数字安全
- 美团技术团队
- TrustedSec
- 安全行者老霍
- Over Security - Cybersecurity news aggregator
- Chinese state hackers target telcos with new malware toolkit
- Bing AI promoted fake OpenClaw GitHub repo pushing info-stealing malware
- FBI investigating hack on its wiretap and surveillance systems: report
- New Jersey county says malware attack took down phone lines, IT systems
- Italian prosecutors confirm journalist was hacked with Paragon spyware
- Wikipedia hit by self-propagating JavaScript worm that vandalized pages
- Patch, track, repeat: The 2025 CVE retrospective
- Ukrainian women fleeing war exploited in multimillion-dollar gambling fraud scheme
- FBI arrests suspect linked to $46M crypto theft from US Marshals
- WordPress membership plugin bug exploited to create admin accounts
- Phobos ransomware leader facing 20 years in prison after pleading guilty to hacking charges
- Cybercrime e AI: l’attribuzione degli attacchi diventa sempre più difficile
- Neutralizzata Tycoon 2FA, il kit phishing che aggirava l’MFA e compromesso migliaia di account
- La nuova dimensione strategica della sicurezza: oltre il cyber, tra AI e domini immateriali
- CTFs Aren't Designed to Train Investigators. Hashclue Is.
- Esclusioni e premi assicurativi in rialzo: l’effetto NIS2 e Cyber Resilience Act sulle polizze cyber
- Google says 90 zero-days exploited in 2025 as commercial vendor activity grows
- 2026 Browser Data Reveals Major Enterprise Security Blind Spots
- Google says 90 zero-days were exploited in attacks last year
- Quando il rischio torna nel mondo fisico: il cloud e la sicurezza dimenticata
- ‘We’re not trying to remake the economy’: FTC’s Mufarrige charts new course on tech enforcement
- Israel Claims it ‘Struck’ Iran’s Cyber Warfare Headquarters
- Police dismantle major phishing platform blamed for attacks on hospitals and schools
- Police dismantles online gambling ring exploiting Ukrainian women
- ClipXDaemon: Autonomous X11 Clipboard Hijacker Delivered via Bincrypter-Based Loader
- 62 people indicted by Taiwanese prosecutors over ties to cyber scam company Prince Group
- UAT-9244 targets South American telecommunication providers with three new malware implants
- Threat Coverage Digest: New Malware Reports and 2,400+ Detection Rules
- Iran, Russia e non solo: l’architettura della repressione digitale
- Cisco flags more SD-WAN flaws as actively exploited in attacks
- Florida Software Distributor Sentenced for Illicit Microsoft COA Trafficking
- La Direttiva NIS2 e la gestione della sicurezza nella supply chain
- Phobos ransomware admin pleads guilty to wire fraud conspiracy
- FBI and Europol Dismantle LeakBase Cybercrime Forum With 142,000 Users
- 迪哥讲事
- 威胁猎人Threat Hunter
- Securityinfo.it
- ICT Security Magazine
- Eric Conrad
- Javvad Malik
- LockBoxx
- Trend Micro Research, News and Perspectives
- The Hacker News
- Preparing for the Quantum Era: Post-Quantum Cryptography Webinar for Security Leaders
- Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities
- ThreatsDay Bulletin: DDR5 Bot Scalping, Samsung TV Tracking, Reddit Privacy Fine & More
- Dust Specter Targets Iraqi Officials with New SPLITDROP and GHOSTFORM Malware
- Where Multi-Factor Authentication Stops and Credential Abuse Starts
- APT28-Linked Campaign Deploys BadPaw Loader and MeowMeow Backdoor in Ukraine
- Europol-Led Operation Takes Down Tycoon 2FA Phishing-as-a-Service Linked to 64,000 Attacks
- FBI and Europol Seize LeakBase Forum Used to Trade Stolen Credentials
- TorrentFreak
- SANS Internet Storm Center, InfoCON: green
- Security Affairs
- Instapaper: Unread
- Your Open Hacker Community
- bellingcat
- Blackhat Library: Hacking techniques and research
- Deeplinks
- netsecstudents: Subreddit for students studying Network Security and its related subjects
- DLLHijackHunter v1.2.0 - Now with automated UAC Bypass & COM AutoElevation discovery
- CyberFirst Bursary scheme tips
- Should I skip eJPT if I'm doing the HTB Penetration Tester Path?
- Built a multithreaded port scanner in C
- [CTF Help] WordPress VM - LFI wrapper failing on config & SQLi Nonce missing (1/5 Flags)
- Social Engineering
- Information Security
- compliance audits taking weeks to prepare is killing me and I don't know how to fix it
- I found this OSINT
- 🚨 M365 Account Takeover Without Credential Theft: Surge in OAuth Phishing
- The Human Firewall: Smart Organizations Invest in Security Training for LMS
- Latrodectus Malware Analysis: A Deep Dive into the Black Widow of Cyber Threats
- The Register - Security
- Schneier on Security
- DEFION Research Labs
- Ruckus Unleashed: Multiple vulnerabilities exploited
- Pwn2Own Automotive 2024: Hacking the Autel MaxiCharger
- Pwn2Own Automotive 2024: Hacking the JuiceBox 40
- Pwn2Own Automotive 2024: Hacking the ChargePoint Home Flex (and their cloud...)
- DoNex/DarkRace Ransomware Decryptor
- CVE-2024-20693: Windows cached code signature manipulation
- Bringing process injection into view(s): exploiting all macOS apps using nib files
- Don’t Talk All at Once! Elevating Privileges on macOS by Audit Token Spoofing
- Getting SYSTEM on Windows in style
- Technical analysis of the Genesis Market
- Bad things come in large packages: .pkg signature verification bypass on macOS
- Pwn2Own Miami 2022: ICONICS GENESIS64 Arbitrary Code Execution
- Pwn2Own Miami 2022: Unified Automation C++ Demo Server DoS
- Pwn2Own Miami 2022: AVEVA Edge Arbitrary Code Execution
- Process injection: breaking all macOS security layers with a single vulnerability
- Pwn2Own Miami 2022: Inductive Automation Ignition Remote Code Execution
- Pwn2Own Miami 2022: OPC UA .NET Standard Trusted Application Check Bypass
- CoronaCheck App TLS certificate vulnerabilities
- Sandbox escape + privilege escalation in StorePrivilegedTaskService
- Proctorio Chrome extension Universal Cross-Site Scripting
- Zoom RCE from Pwn2Own 2021
- Adobe Acrobat privilege escalation
- iOS VPN support: 3 different bugs
- Sign in with Apple - authentication bypass
- Jenkins - authentication bypass
- DNS rebinding for HTTPS
- Spring Security - insufficient cryptographic randomness
- XenServer - path traversal leading to authentication bypass
- Volkswagen Auto Group MIB infotainment system - unauthenticated remote code execution as root
- NAPALM - command execution on NAPLM controller from host
- MySQL Connector/J - Unexpected deserialisation of Java objects
- Ansible - command execution on Ansible controller from host
- Observium - unauthenticated remote code execution
- cSRP/srpforjava - obtaining of hashed passwords
- StartEncrypt - obtaining valid SSL certificates for unauthorized domains
- Technical Information Security Content & Discussion
- we at codeant found a bug in pac4j-jwt (auth bypass)
- 2,622 Valid Certificates Exposed: A Google-GitGuardian Study Maps Private Key Leaks to Real-World Risk
- Your Duolingo Is Talking to ByteDance: Cracking the Pangle SDK's Encryption
- YGGtorrent — Fin de partie [French]
- Normalized Certificate Transparency logs as a daily JSON dataset
- Credential Protection for AI Agents: The Phantom Token Pattern
- HPD (Hex Packet Decoder) now have AI feature – looking for feedback
- Computer Forensics
- GRAHAM CLULEY
- Security Weekly Podcast Network (Audio)
- Project Zero